Policies.life is a personal tool that helps you view your insurance policies by extracting details from your uploaded policy PDFs. We are committed to keeping your data private and under your control.
We do not sell, share, or monetize your data in any way. Your policy information is encrypted and accessible only with your vault key.
Information We Access
When you sign in with Google, we request the following permissions:
Email address — Used to identify your account and associate your policies with your session.
Basic profile info — Your name, used to greet you in the app.
How We Process Your Data
PDF text from policy documents is sent to an AI model (Grok by xAI) to extract structured policy details (insurer, policy number, dates, premium amounts).
Extracted policy data is encrypted with AES-256-GCM using a key derived from your vault password before being stored in the database.
Data Storage
Database: We use Turso (cloud SQLite) to store processing results. Sensitive fields (extraction details, policy information) are encrypted. Without your vault key, this data is unreadable.
Session: Your login session is stored in an encrypted cookie. It contains your email and name — no policy data.
PDFs: Policy PDF files are uploaded for processing, and text is extracted in memory. The files are instantly deleted from our servers after the text is sent to the AI.
Third-Party Services
xAI (Grok API) — For AI-powered policy extraction. PDF text is sent to their API for processing.
Turso — Cloud database for storing encrypted processing results.
Your Vault Key
Your vault key is the password used to encrypt and decrypt your policy data. It is:
Never stored in the database, cookies, or anywhere on the server
Only held in memory during processing
Used to derive an AES-256 encryption key via PBKDF2 (100,000 iterations)
Verified via a one-way hash — we can tell if you entered the wrong key, but we cannot recover the right one
If you forget your vault key, your cached data cannot be recovered. You can still upload your policies again with a new key.
Data Retention
Extracted policy results remain encrypted in the database.
Logging out clears your session but does not delete cached data from the database (it remains encrypted and inaccessible without your vault key).
Your Rights
You can request deletion of your data from our database.
You control your vault key — without it, nobody (including us) can read your policy data.
Contact
For privacy-related questions or data deletion requests, contact the developer at the email associated with this project.